diff --git a/CHANGELOG.md b/CHANGELOG.md
index a83f93e358f53..1e7652bf00462 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -118,7 +118,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `asm` from 9.6 to 9.7 ([#12908](https://github.com/opensearch-project/OpenSearch/pull/12908))
 - Bump `net.minidev:json-smart` from 2.5.0 to 2.5.1 ([#12893](https://github.com/opensearch-project/OpenSearch/pull/12893))
 - Bump `netty` from 4.1.107.Final to 4.1.108.Final ([#12924](https://github.com/opensearch-project/OpenSearch/pull/12924))
-- Bump `commons-io:commons-io` from 2.15.1 to 2.16.0 ([#12996](https://github.com/opensearch-project/OpenSearch/pull/12996))
+- Bump `commons-io:commons-io` from 2.15.1 to 2.16.0 ([#12996](https://github.com/opensearch-project/OpenSearch/pull/12996), [#12998](https://github.com/opensearch-project/OpenSearch/pull/12998), [#12999](https://github.com/opensearch-project/OpenSearch/pull/12999))
 
 ### Changed
 - [BWC and API enforcement] Enforcing the presence of API annotations at build time ([#12872](https://github.com/opensearch-project/OpenSearch/pull/12872))
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index 6da34c4c9caf2..a931f45802318 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -57,7 +57,7 @@ dependencies {
   runtimeOnly "com.google.guava:guava:${versions.guava}"
   // Other dependencies
   api 'org.tukaani:xz:1.9'
-  api 'commons-io:commons-io:2.15.1'
+  api 'commons-io:commons-io:2.16.0'
   api "org.slf4j:slf4j-api:${versions.slf4j}"
 
   // character set detection
diff --git a/plugins/ingest-attachment/licenses/commons-io-2.15.1.jar.sha1 b/plugins/ingest-attachment/licenses/commons-io-2.15.1.jar.sha1
deleted file mode 100644
index 47c5d13812a36..0000000000000
--- a/plugins/ingest-attachment/licenses/commons-io-2.15.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-f11560da189ab563a5c8e351941415430e9304ea
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1
new file mode 100644
index 0000000000000..6a7b638719fa3
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1
@@ -0,0 +1 @@
+27875a7935f1ddcc13267eb6fae1f719e0409572
\ No newline at end of file